以ISO27001探討醫院資訊安全系統

Base on ISO27001 to Search Medical Information Security System

陳維揚(Wei-Yang Chen)

指導教授 ： 吳帆

國立中正大學/管理學院/資訊管理系醫療資訊管理研究所/碩士(2016年)

摘要

資訊安全議題已被廣泛的研究，ISO27001是資訊安全研究必討論的議題，國際標準ISO27001，是目前在資訊安全中最為大眾參考的標準，在探討標準ISO27001的研究中，大多在探討如何完成ISO27001的風險管理以及管理的規範，來達到資訊安全標準，但達到資訊安全標準卻少了系統的支撐，對資訊安全來說是不完善的。
本研究探討醫院資訊安全系統，目的在於針對ISO27001技術條例做系統的建置，讓欲建置資訊系統的醫院，可以參考此系統方法，來對自身的文件以及員工的使用狀況權限得以監看，保護醫院的病患資料，對於中小型的醫院或診所，推動資訊安全，必須考量的不僅只有資訊安全的規範，還要考量到建置上硬體的設備，軟體的需求，才能無慮的建置資訊安全，因此，本研究在建置上，對於硬體的需求減輕中小型醫院或診所的壓力，讓中小型醫院也能擁有一套遵守ISO27001標準的資訊安全系統。

關鍵字

文件管理 ； 資訊安全系統 ； ISO27001

並列摘要

Information security has been studies widely.ISO27001 is important issue of Information security research. ISO27001 is a International standard, It is present in most public reference information security standards. Discussion on the ISO27001, mostly discussing about how to complete ISO27001 risk management and management norms to achieve information security standards. If discussion of information security standards but not discuss about Information security systems is imperfect.
This study investigated the hospital information security system. The purpose is to make the system build for ISO27001 technical regulations. If hospital wants to build information security systems can refer to this systematic approach. This hospital information security system can monitor staff operating scenarios and protect patient data.
In order to small and medium sized hospitals or clinics promote information security, we must consider not only the information security standards but also device hardware and software. Therefore, this study on the building can reduce the pressure for small and medium sized hospitals so that small and medium sized hospitals can also have a set of standards to comply with ISO27001 information security system.

並列關鍵字

Document Management ； Information Security System ； ISO27001

參考文獻

Ahmad, S., Alam, K. M. R., Rahman, H., & Tamura, S. (2015). A comparison between symmetric and asymmetric key encryption algorithm based decryption mixnets. 2015 International Conference on Networking Systems and Security (NSysS).1-5. IEEE.

Barrows, R. C., & Clayton, P. D. (1996). Privacy, confidentiality, and electronic medical records. Journal of the American Medical Informatics Association, 3(2), 139-148.

Calder, A. (2013). Information Security & ISO 27001-An Introduction. United Kingdom：IT Governance Green.

Fanfara, P., Danková, E., & Dufala, M. (2012). Usage of asymmetric encryption algorithms to enhance the security of sensitive data in secure communication. 2012 IEEE 10th International Symposium on Applied Machine Intelligence and Informatics (SAMI), 213-217. IEEE.

Garg, R.M.,&Singh, M.(2013). Evolving profligate and conspicuous web applications using reverse AJAX. International Conference on Computing, Communications and Networking Technologies (ICCCNT).1-5.